ãã·ã¢ã³ãŒãã«ãã2013ã®æ±ºå倧äŒã®ã²ã¹ãã®ã¹ããŒãã®æŠèŠããHabrã®äœæ°ãšå ±æãç¶ããŸããæ¬æ¥ããªããŒã¹ãšã³ãžãã¢ãªã³ã°ã«é¢ããDmitry Sklyarovã®ã¹ããŒãªãŒã®æŠèŠãã玹ä»ããŸãã
ããããªãŒã»ã¹ã¯ãªã£ãã-MSTUæ å ±ã»ãã¥ãªãã£åŠéšåææã Baumanããã³Positive Technologiesã®ã¢ããªã¹ãã 圌ã¯æ å ±ã»ãã¥ãªãã£ã®åéã§13幎以äžåããŠããŸãã Advanced eBook Processorã®ã¢ã«ãŽãªãºã éçºè ã
ãã¡ãããé転ã¯ITåéã§æãç°¡åãªåéã§ã¯ãããŸããã ãã ããçµæãååŸãããããã€ãŸããããã°ã©ã ã®æ©èœãç解ããããã«ãã³ãŒãã®åè¡ãšåã¢ã»ã³ãã©ãŒã³ãã³ããåžžã«åæããå¿ èŠã¯ãããŸããã ããã€ãã®åçŽãªè«çççµè«ãšãããã°ã©ãã®ããã«èãããèœåã§ååãªå ŽåããããŸãã ç§ã®èšãããããšãç解ããããã«ãç§ã®å®è·µããåŸãããåæã®2ã€ã®äŸã圹ç«ã¡ãŸãã
ãã©ãã¯ããã¯ã¹ã®äžèº«ã¯äœã§ããïŒ
CTFã§æåã®èª²é¡ã«çŽé¢ããŸããã CTFã¯äžçš®ã®ãªãªã³ãã¢ãŒãããã°ã©ãã³ã°ã§ãããæ å ±ã»ãã¥ãªãã£ã®åéã®å°é家å°çšã§ãã ããã·ã§ã³ã¯ãã³ããŒããšåŒã°ããŠããŸããã ã ãããç§ãã¡ã¯äžããããŸãïŒ
- ããã°ã©ã ã§å®è£ ãããããã©ãã¯ããã¯ã¹ã-å ¥åã·ãŒã±ã³ã¹ãåºåã«å€æããå®è¡å¯èœãã¡ã€ã«
- åºåãããå€
å ¥åã«äŸçµŠãã12ãã€ãã®ã·ãŒã±ã³ã¹ã決å®ããå¿ èŠããããŸãã
æããã«ããã®ã¿ã¹ã¯ã¯åçŽãªç¶²çŸ çæ€çŽ¢ã§ã¯è§£æ±ºãããŸããã ããã°ã©ã å ã§äœãèµ·ããããå ¥åãåºåã«å€æãããã®ãããã³ç¹å®ã®åºåãåŸãããã«å ¥åå€ãéžæããæ¹æ³ãèŠã€ããå¿ èŠããããŸãã
ãã¡ãããæåã®æ®µéã§ãããã°ã©ã ã¯éã¢ã»ã³ãã©ã«ããŒããããŸãã 以äžã¯ã圌ãçºè¡ãã2ã€ã®ã³ãŒãã§ãã
ããã§ãã¢ã»ã³ããªããã»ã¹ããæ®ã£ãŠããè¡ã«ç°¡åã«æ°ä»ãããšãã§ããŸãã ã»ãšãã©ã®å Žåããããã®ã¡ãã»ãŒãžã¯ãäœãè°è«ãããŠããããæšæž¬ããããããããã«ãäž»å¬è ã«ãã£ãŠç¹å¥ã«äœæãããŸããã ç§ã®é ã®vm_set_paramsãšvm_get_outputã®è¡ãèŠããšãçåãããã«çããŸãïŒvmãšã¯äœã§ããïŒ ããã«ãäžè¬çã«ãä»®æ³ãã·ã³ã®ã¿ãæãæµ®ãã³ãŸãã ãããã£ãŠãããã§ä»®æ³ãã·ã³ã䜿çšãããŠãããšããã«æ³å®ããããã«åºã¥ããŠããã«åæãæ§ç¯ã§ããŸãã
4ã€ã®é£ç¶ããé¢æ°åŒã³åºãããããŸãïŒãããã®éã®ãã€ã³ãã¯ãã©ã¡ãŒã¿ãŒã®æºåã«ãããŸããïŒã ãã©ã¡ãŒã¿ã®ããŒããšçµæã®æœåºã®éã«äœãã§ããã®ã§ããããïŒ ä»®æ³ãã·ã³ã®åæåãšèµ·åããããšä»®å®ããã®ã¯è«ççã§ãã VMåæåã³ãŒããéã¢ã»ã³ãã«ããŠã¿ãŸãããã
ãã®ãããvm_initã³ãŒãã確èªãããšãããªãå€æ°ã®æ確ã§ã¯ãªãæäœãèŠãããŸãã ã€ã³ãã«ãšäºææ§ã®ããã³ã³ãã¥ãŒã¿ãŒã®ã¢ã»ã³ããªèšèªã«ã»ãŒ20幎é粟éããŠãããšããäºå®ã«ãããããããæµ®åå°æ°ç¹åœä»€ãåæããããšã¯ãã£ãã«ãããŸããã ãããã£ãŠããã£ã¬ã¯ããªã®å©ããåããã«ãã®ã³ãŒããèŠãã ãã§ã¯ããããäœãããã®ããèšããŸããã ãã®ã³ãŒãããã©ã®ãããªçµè«ãåŒãåºãããšãã§ããŸããïŒ
- 64ãããMMXã¬ãžã¹ã¿ã䜿çšããŸã
- æ©èœã³ãŒãã¯420åã®ã³ãã³ãã§æ§æãããŠããŸã
- äœãæ確ã§ã¯ãããŸãã
ãã¡ãããããŒãããã¯ã«åº§ã£ãŠ420ã®ããŒã ãã¹ãŠãåæããããããã®ããŒã ãäœãããŠãããããããã£ãŠçµæãšããŠäœãèµ·ããããç解ããããšãã§ããŸãã ããããããã¯æãå¹æçãªæ¹æ³ã§ã¯ãªããšæãããããããã®ã¿ã¹ã¯ã«å¥ã®æ¹æ³ã§ã¢ãããŒãããããšã«ããŸããã
åæããŒã¿ããã¬ãžã¹ã¿ãäœããã®åœ¢ã§ããŒãããé¢æ°vm_initããããŸãã å ¥åã¯8ã€ã®32ãããå€ã§ãã ãããã®å€ã«å®æ°ãèšå®ãã00ãã1FãŸã§ã®ãã€ããããŒã¯ãããšã©ããªããŸããïŒ
åãã€ãã1åã³ããŒãããããšãããããŸãã åäžã®ç¹°ãè¿ããåäžã®æ°ããå€ã¯ãããŸãããç°ãªãè²ã§è²ä»ãããã ãã§ãã©ã®ãã€ãããããã³ã°ãããŠãããã確èªã§ããŸãã
ãã®ããã1è¡ã解æããããšãªããåã«å ¥åãšåºåãæ¯èŒããã ãã§ãé¢æ°ã®æ©èœãç解ããŸããã ãã®æ¹æ³ã§ãããè¡ãããšãã§ãããšææ¡ããã®ã¯ãªãã§ããïŒ ããã¯è«ççã§ãããããããã¯ãŸãã«ä»®æ³ãã·ã³ã®åæç¶æ ã®ããŒãæ©èœããæåŸ ããããã®ã§ãã
ãã®åŸãvm_runãšåŒãã é¢æ°ãäœãããã®ãåæããããšã«ããŸããã ãã®äžã«ã¯æ¬¡ã®ãã®ããããŸãã
- ãã«ãã¡ãã£ã¢ã¬ãžã¹ã¿ãæäœããããã®èšå€§ãªæ°ã®ã³ãŒã
- ä»®æ³ãã·ã³ã®ã³ãã³ãã¹ããªãŒã ã解æãããšããåã³ãã³ãã³ãŒãã1ãã€ããåãã1ã€ã®åŒæ°ãããããšã¯æããã§ãïŒãªãã·ã§ã³ïŒ
- ã³ãã³ãã®åãã€ãã«ã¯ç¬èªã®åŠçæ©èœããããŸã
- ååŠçé¢æ°ã®è€éãã¯vm_initã®å Žåãšã»ãŒåãã§ãïŒãããã£ãŠããããå解ããããšããããããªæ¬²æ±ã¯ãããŸãããããã¯é£ãããããããæãå¹ççãªæ¹æ³ã§ã¯ãããŸããïŒ
- ã»ãšãã©ã®åœä»€ã¯å®éã«ã¯åããã³ãã©ãŒã«ããããããŸãïŒããããããã¯nopé¢æ°ã§ãïŒ
- ãã¹ãŠã®åŠçã1ãµã€ã¯ã«ã§è¡ãããŸã
ãã®ãããä»®æ³ãã·ã³ã®ã³ãã³ãã解æããæšæºããã»ã¹ããããŸãïŒãªãã©ã³ããæãã³ãã³ãã³ãŒããšãã®åŒæ°ãååŸãã1ã€ãŸãã¯å¥ã®ãªãã¬ãŒã·ã§ã³ã³ãŒããå®è£ ããé¢æ°ãéããŠå®è¡ããŠããã次ã®ãªãã¬ãŒã·ã§ã³ã³ãŒãã«é²ã¿ãŸãã
å°ããªãããã¬ãŒãäœæããŸããããããã°ã©ã ãäœãããã®ãã段éçã«èŠãã®ã§ã¯ãªããåãã€ã³ãã§ãã¹ãŠã®MMXã¬ãžã¹ã¿ãŒã®ã¹ããŒã¿ã¹ããã¬ãŒã¹ããããšã«ããŸããã ãã®çµæããã°ãã¡ã€ã«ãäœæãããçŸåšã®åã³ãã³ãã«ã€ããŠãå®è¡ã®ååŸã«VMã®ç¶æ ãèšé²ãããæäœã³ãŒããš1ãã€ããè¿œå ãããæäœã³ãŒããèªèããŠããžãã¯ã埩å ã§ããããã«ãªããŸããã
ããã«ç§ãåŸããã®ããããŸãïŒ
ã¬ãžã¹ã¿R0ã®å€ã¯å ¥åã«éãããåºåã§ã¯ã¹ã¿ãã¯ã«çœ®ãããŸãã ã¬ãžã¹ã¿R6ã®å€ãæžå°ããéã«R7ãå¢å ããããšãããããŸãã
ãã®ããšãããR6ã¯ã¹ã¿ãã¯ãžã®ã«ãŠã³ã¿ãŒãã€ã³ã¿ãŒã§ãããããŒã¿ãã¹ã¿ãã¯ã«è¿œå ãããšæžå°ããR7ã¯ã³ãã³ããžã®ãã€ã³ã¿ãŒã§ãããšçµè«ä»ããããšãã§ããŸãã ãã®å Žåããªãã¬ãŒã·ã§ã³ã³ãŒã0D-00ã®ã³ãââã³ãã¯ããŒãã¬ãžã¹ã¿ããã¹ã¿ãã¯ã«å€ã転éããŸããã
R4ã¬ãžã¹ã¿ã«ãã£ãå€ã¯åã³ã¹ã¿ãã¯äžã«ãããã³ãã³ãã³ãŒã0D04ã¯åŒæ°ã®ã¿ãåã®ãã®ãšç°ãªããŸãã ãã®ããšãããããã·ã¥ãªãã¬ãŒã·ã§ã³ã³ãŒãã§ãã0Dã¯ã¹ã¿ãã¯äžã®ããŒã¿ã®é 眮ã§ããããªãã¬ãŒã·ã§ã³ã³ãŒãã®åŸã®æåã®ãã€ãã®å€ã¯ããã®ãªãã¬ãŒã·ã§ã³ã§äœ¿çšãããã¬ãžã¹ã¿çªå·ãžã®ãã€ã³ã¿ã§ãããšæ³å®ã§ããŸãã
å®è¡ååŸã®ã¬ãžã¹ã¿ã®ç¶æ ã¯1ã€ã®ã¬ãžã¹ã¿ã§ã®ã¿ç°ãªããŸãããããåœä»€ãã€ã³ã¿ïŒInstruction PointerïŒãšåŒã³ãŸããããã¯ãå€æŽãçºçããŠããªãããšãæå³ããŸãã ãããã£ãŠããªãã¬ãŒã·ã§ã³ã³ãŒã06ã¯äœãããªãnopã§ãããšæ³å®ã§ããŸãã
ãã®å ŽåãåŒæ°ã¯FFã®å€ã§ãããã¹ã¿ãã¯äžã«ãããã¹ã¿ãã¯ãã€ã³ã¿ãŒã¯æžå°ããŸããã ãã®ã³ãã³ãã¯ãåŒæ°ã«ãã£ãå€ã32ãããå€ãšããŠã¹ã¿ãã¯ã«ããŒããããšããä»®å®ãç«ãŠãã®ã¯ç°¡åã§ãã
ãã®ã³ãã³ããå®è¡ããããšããã¹ã¿ãã¯ã®å€ã¯2çªç®ã®ã¬ãžã¹ã¿ã«ãããŸããã ãããã£ãŠããªãã¬ãŒã·ã§ã³ã³ãŒã4Cã¯ã¹ã¿ãã¯ããã®æœåºã§ãããããã«ç¶ãåŒæ°ã¯ã¬ãžã¹ã¿çªå·ã§ãã ãã®ãããªä»®å®ã¯ãåçŽã«å ¥åãšåºåã®ãã¢ãèŠãã ãã§è¡ãããšãã§ããŸãã
ãããã³ã«ãå®å šã«åæãããäžèŠãªè¡ã倱ãããåŸããã®ä»®æ³ãã·ã³ã§ã¯å°æ°ã®ã³ãã³ãã䜿çšãããŠããããšãå€æããŸããã nopã³ãã³ãããããŸããããã¯ãã¬ãžã¹ã¿ããã¹ã¿ãã¯ã«ããŒã¿ãé 眮ããã¹ã¿ãã¯ããããŒã¿ãååŸããã¬ãžã¹ã¿éã移åããè¿œå ããè«çæŒç®ããxorãã·ããããã³ãã³ãã§ãã
movãå·Šã·ãããªã©ã®äžéšã®æäœã¯ã2ã€ãŸãã¯3ã€ã®ç°ãªãæ¹æ³ã§å®è£ ãããŸãããéèŠã§ã¯ãããŸãã-ããããäœãããŠããã®ãã¯æ¢ã«ããã£ãŠããŸãã ãã®ããããããã³ã«ãæžãããåŸããã®ä»®æ³ãã·ã³ã®èšèªã§ããã°ã©ã ã®ãªã¹ããååŸããŸããã ãããåçŽã«åæããå ã«æ»ãããšãæ®ã£ãŠããŸãã
æ®å¿µãªããããã¹ãæéã®çµäº15ååŸã«ãã®åé¡ã解決ããŸãããã€ãŸãããªããšãåæ Œããããšã¯ã§ããŸããã§ãããããœãªã¥ãŒã·ã§ã³ããã»ã¹èªäœã¯éåžžã«èå³æ·±ããã®ã§ããã ãªãã§ãããªã«ã·ã³ãã«ã«ãªã£ãã®ïŒ ã¿ã¹ã¯ã®äœæè ã¯ãããã»ããµã®MMXã¬ãžã¹ã¿ã«ä»®æ³ãã·ã³ã®ç¶æ å šäœãå®è£ ããããã§ãã
å éšã§çºçããä»ã®ãã¹ãŠã¯ãä»®æ³ãã·ã³ã®å®å šã«è«ççãªæäœã§ãã åçŽãªä»®æ³ãã·ã³ã®äœæãéå§ããå Žåãã»ãŒåãæ¹æ³ã§äœæããŸãã ã¬ãžã¹ã¿ãMMXã¬ãžã¹ã¿ã«äžæã®æ¹æ³ã§ãããããããã®äžæã®ãããã³ã°ãç°¡åã«èå¥ã§ãããšããå¯äžã®ã¢ã€ãã¢ã䜿çšããŠãã¢ã»ã³ãã©ã³ãŒãã®åæã«é Œãããšãªãåé¡ã解決ããŸããã
ããã¯ãšãŠãä¿¡é Œã§ããŸããïŒ
ãã§ã«å®éã«çºçãã2çªç®ã®åé¡ã¯ãéã¢ã»ã³ãã©ããŸã£ããããŒãããã«è§£æ±ºã§ããŸããã ã·ã¹ãã æ©åšã®å®å šæ§ã®åæã«æºãã£ãŠããååãç§ã®ãšããã«æ¥ãŠããã¹ããå¿ èŠãªæ°ããããŒããŠã§ã¢ãåãåã£ããšèšããŸããã
ãã®éšåã§ã¯ãèšå®ã§äœããã®å€ã«å€æããããã¹ã¯ãŒããèšå®ã§ããŸãã å€ã¯æååã§ãããçš®ã®ããã·ã¥ã®ããã«èŠããŸãããã©ããæ確ã§ã¯ãããŸããã ç§ã®ä»äºã¯ãå©çšå¯èœãªæ§æãåæããããšã«ãããååãããã€ã¹ãã©ã®çšåºŠä¿è·ããããè©äŸ¡ããããã«å¿ èŠãªã¢ã«ãŽãªãºã ã®è©³çŽ°ããã¹ãŠèŠã€ããããšã§ããã
9人ã®ãŠãŒã¶ãŒã®ãã¹ã¯ãŒããçæããŸããã
äžç®ã§èŠãããã®ã¯äœã§ããïŒ ãã¹ãŠã®ãã¹ã¯ãŒãã®æåŸã®æåã¯åãã§ãããæåã®æåã¯å€§å¹ ã«å€æŽãããŠããããšãããããŸãã ããã«ãããã·ã¥ã¯åžžã«24æåã§ãããæåŸã®13æåã¯å€æŽããããåèš50ã®ç°ãªãæåãå¥èªç¹ããã³æ°åã䜿çšãããããšã¯æããã§ãã
æ®å¿µãªãããããã¯æããã«ããã¹ã¯ãŒããããã·ã¥ã«å€æããã¢ã«ãŽãªãºã ã®å éšã§äœãèµ·ãã£ãŠãããã«ã€ããŠã®ææ矩ãªçµè«ã«ã¯ååã§ã¯ãããŸããã
ç§ã¯ãããã®ãã¹ã¯ãŒãããã£ãšå¿ èŠãšããã¿ããªã«ãããããããã«é Œã¿ãŸããããããã¯äžæ¥ã®çµããã§ãããç§ã¯ããã«ãã¹ã¯ãŒããåãåããŸããã§ããã ããããæ°ããããŒã¿ãç»å Žããåã«ãããã€ãã®æšæž¬ãããããšãã§ããŸããã
- ããã€ãã®ããããããå°ãªããããã«ãšã³ã³ãŒããããšã³ã³ãŒãã䜿çšãããŸãã ããããããããã¯Base16ãBase32ãBase64ãªã©ã®æšæºãšã³ã³ãŒãã£ã³ã°ã§ãã
- æåæ°> = 50ã§ããã50æåã¯ã©ããããããã¯ãŒã«ã§ã¯ãªãã2ã®çŽ¯ä¹ã§ã¯ãããŸããã äžæ¹ããšã³ã³ãŒãã£ã³ã°ããŒãã«å ã®64æåã¯ãããªãè¯ãæšæž¬ã§ãã ãªãã§ïŒ Base64ã¯ã1æåã6ãããããšã³ã³ãŒãããããšãæå³ãããããåèšã§64ã®ç¶æ ããããŸãã
- ãã¹ã¯ãŒãã¯24æåã§ã13æåã¯å€æŽãããã11æåã¯å¯å€ã§ãã ãããã®ããããã6ããããã€ãŸã66ãããã®å€åãè¡šãå Žåãããã¯ãã§ã«2ã®çŽ¯ä¹ããã³8ãã€ããããã¯ã«ååã«è¿ãã§ãã
- æããã«ãmime64ã¯äœ¿çšã§ããæåãæ確ã«å®çŸ©ããæäŸããããã¹ã¯ãŒãããã·ã¥ã¯ç¡å¹ãªæåã䜿çšãããããmime64ãæ±ã£ãŠããŸããã
- ãããã£ãŠãmime64以å€ã®ãšã³ã³ãŒãããŒãã«ã䜿çšããŠãBase64ã«é¡äŒŒãããšã³ã³ãŒããè¡ãããŸãã ããã«ãããã·ã¥ã¯æ確ã«èŠãã2ã€ã®éšåã«åå²ãããäžæ¹ã¯å€åããããäžæ¹ã¯å€åããŸããã ããã¯ãããããæå·åã64ããããããã¯ã§äœ¿çšãããåãããã¯ãåå¥ã«æå·åãããããšã瀺åããŠããŸãã
å ¥åçŽ æããªãéã«ä»ã«äœãã§ããŸããïŒ æ€çŽ¢ã䜿çšã§ããŸãã äžå®ã®è¡ãæ¢ããšãæ€çŽ¢ãšã³ãžã³ã¯ãã®è¡ãèšåãããŠããçŽ43,000ããŒãžãèŠã€ããããšãããããŸãã ããã¯é©ãããšã§ã¯ãããŸãããæ©åšã¯åºãæ®åããŠããã人ã ã¯ããã¥ã¡ã³ããæ§æãã¡ã€ã«ã®äžéšã䜿çšããŠåé¡ã説æããããšããããããŸããã ãã®è¡ãèŠã€ãã£ãããŒãžãã¹ã¯ããŒã«ããŠãããã«ãªã¹ããããŠããããã·ã¥ã®æçãåéããŸããã æ£ç¢ºã«64æåã䜿çšãããŠããããšãå€æããŸããã ããã«ãããŸãïŒ
ïŒ "ïŒ$ïŒ ïŒ 'ïŒïŒ* +ã-ã/ 0123456789 :; <=> @ A
BCDEFGHIJKLMNOPQRSTUVWXYZ [\] ^ _ `a
ããã§ãæåã»ããã埩å ããŸããã ãããããã£ã©ã¯ã¿ãŒèªäœã«å ããŠãããªãã¯åœŒããã©ã®é çªã§è¡ãããç¥ãå¿ èŠããããŸãã ãã¹ãŠã®æåã次ã ã«é²ãçµ±èšçãªã·ãŒã±ã³ã¹ããããŸããããïŒãã¯ãããŸãããæåŸã«ãæå®ããããã¹ãŠã®æåã®äžã§æ倧ã®ã³ãŒããæã€æåãaãããããŸãã ãã ããã©ã®é åºã§é²ãã¹ããã¯æ確ã§ã¯ãªããã€ã³ã¿ãŒãããã¯ãã®åé¡ã解決ã§ããŸããã
ã€ã³ã¿ãŒãããã§èŠã€ãã£ãããã¥ã¡ã³ãããä»ã«äœãåŸãããŸããïŒ ãã¹ã¯ãŒãã16æå以äžã®å Žåã24æåã®æååã§æå·åããããšããèšè¿°ããããŸãã ãã¹ã¯ãŒãã16ã63æåã®å Žåã88æåã®è¡ã«ãªããŸãã ããã«ããã®ãããªæ°ã®æåã¯éåžžã«ç°¡åã«èª¬æã§ããŸãã
24 * 6 == 144 == 18 * 8 ==ïŒ2 * 8 + 2ïŒ* 8
88 * 6 == 528 == 66 * 8 ==ïŒ8 * 8 +2ïŒ* 8
24åã®6ãããæåã䜿çšãããšã144ããããåŸãããŸããããã¯ã2ã€ã®8ãã€ããããã¯ãšããã«2ãã€ãã«ç°¡åã«åå²ã§ããŸãã 88æåãåæ§ã«8ã€ã®8ãã€ããããã¯ãš2ãã€ãã«åå²ãããŸãã å ¥åæåãé±æ«ã®æåã«å€æããããã®è«ççã§äºæž¬å¯èœãªã¹ããŒã ããããŸãã ãã¹ã¯ãŒãã®æåæ°ã16æåæªæºã®å Žåããããããæå·åããã2ã€ã®8ãã€ããããã¯ãååŸããæåŸã«2ãã€ããè¿œå ããŸããããã¯ãã¹ãŠãšã³ã³ãŒããããŸãã
æåŸã«ãç§ã®ååã¯ç§ã®ããã«511åã®ãã¹ã¯ãŒããçæããŸããã ããŸããŸãªé·ãã®ãã¹ã¯ãŒãã空ã®ãã¹ã¯ãŒãã16ãè¶ ãããã¹ã¯ãŒããèŠæ±ããŸããããã®ç¹å®ã®ããã€ã¹ã¯16æåãè¶ ãããã¹ã¯ãŒãã®ããã·ã¥ãäœæã§ããã空ã®ãã¹ã¯ãŒããèšå®ã§ããªãããšãããããŸããã ãã ãã0000ãã0510ã®å€ãæã€ãã¹ã¯ãŒãããã·ã¥ãçæãããŸããã
äºæ³ã©ããããããã®ããã·ã¥ã¯ãã¹ãŠæåŸã®13æåãå€æŽããã0ã9ã®äœçœ®ã§ã以åã«ã€ã³ã¿ãŒãããæ€çŽ¢ã§èŠã€ãã64æåã®ããªã¢ã³ãããã¹ãŠèŠã€ãããŸããã
10çªç®ã®äœçœ®ã§ã¯ãäžã®ç»åã§èµ€ã§åŒ·èª¿è¡šç€ºãããŠããæåã®ã¿ããããŸããã
èšå·ãããªãªã4ãšäº€äºã«ãªã£ãŠããã®ã¯å®¹æã«ããããŸããæåãaãã®é åã§ã¯ã亀代ãäžæãããããã«äº€ä»£ãæåŸã«åã³äžæãããŸãã æåãaãããã®å Žæã«åé 眮ãããè¡æ¹äžæã®ãïŒããç«ã£ãŠããå Žåã¯ã©ããªããŸããïŒ çµæã¯éåžžã«çŸããç»åã§ããã4æåã®æ確ãªæéã芳å¯ããŸãã
ããã¯ãæåããšã³ã³ãŒãããããšããã«æ£ç¢ºã«ç§»åããæ£ããããŒãã«ã§ãããšæ³å®ã§ããŸãã ããããã1ã€ç¢ºèªããŸããé·æ¹åœ¢ã§åŒ·èª¿è¡šç€ºãããŠããæåŸã®4æåã¯ãç°ãªãé·ãã®ãã¹ã¯ãŒãã®ããã·ã¥ã瀺ã次ã®å³ã§èµ€ã§åŒ·èª¿è¡šç€ºãããŠããŸãã
ãã®ãªã¹ãããããã¹ã¯ãŒãã¯8æå以äžã§ãããããã·ã¥ã®å³ååã¯äžå®ã§ããããšãããããŸãã ãã¹ã¯ãŒãã«8æå以äžãå«ãŸããŠããå ŽåãæåŸã®2æåãå€æŽããããæåã®10æåã¯å®æ°ã§ããã11çªç®ã¯4ã€ã®ç¶æ ãåãã11æåã®ãããã¯ãæ··oticãšããŠå€åããŸãã
ã©ã®ãããªã¹ããŒã ã®äžã§ããã®å€åã®è«çã調æŽã§ããŸããïŒ
- pwd [0ïŒ8]ã¯out [0:10] + 4ãããout [10]ã«åœ±é¿ããŸã
- pwd [8:16]ã¯2ãããåºå[10] +åºå[11:21] + 2ãããåºå[21]ã«åœ±é¿ããŸã
- out [22:24] ==â !!â
以åã«ååŸããã¢ã«ãã¡ãããã«åŸã£ãŠBase64ãšã³ã³ãŒããè¡ãããæ©èœã説æããããšã¯éåžžã«å¯èœã§ãã å éšã«ã¯ã2ã€ã®8ãã€ããããã¯ã®é£çµããããŸããããã¯ããã¹ã¯ãŒãã®ååãšåŸåããã®é¢æ°ã®èšç®ã§ãããæåŸã«2ã€ã®ãŒããã€ããè¿œå ãããŸããããã¯ãåããšã³ã³ãŒãããŒãã«ã䜿çšããŠæå笊ã«å€ãããŸãã
Base64ïŒfnïŒpwd [0ïŒ8]ïŒ+ fnïŒpwd [8:16]ïŒ+â \ 0 \ 0âïŒ
åè·¯ã¯çŸããã§ãããæªç¥ã®èŠçŽ ã1ã€ãããŸãããã®é¢æ°ãäœã§ãããã¯ããããŸããã é¢æ°ã¯ãã¹ã¯ãŒãã®8æåãåºåã«æ£ç¢ºã«ã©ã®ããã«å€æããŸããïŒ ããã£ãŠããã®ã¯ã64ããããã64ãããã«å€æãããŠããããšã ãã§ãã çè«çã«ã¯ãããã¯ããã·ã¥é¢æ°ãããããŸãããã第äžã«ãé »ç¹ã«äœ¿çšãããè¯ã64ãããããã·ã¥é¢æ°ãç¥ããŸããã第äºã«ãå ¥åã®ãµã€ãºãåºåã®ãµã€ãºã«çããããšã¯ãªããšãªãçãããã§ãã ãã¹ã¯ãŒãå šäœãããã·ã¥é¢æ°ã®å ¥åã«éä¿¡ããåºåã§æå®ãããé·ãã®å€ãååŸããæ¹ãç°¡åã§ãã
ãããããããã¯64ããããããã¯ã䜿çšããæå·åã¢ã«ãŽãªãºã ã§ãã ç§ã¯ã¢ã«ãŽãªãºã ãäœã§ãããã調ã¹ãããšã«ããŸããããããŠãå€ãã®ãªãã·ã§ã³ãããããããã¯å€ããå°ãªãã人æ°ãããããšãå€æããŸããã ããã«ãã¢ã«ãŽãªãºã ãç¥ã£ãŠããŠããæãéèŠãªèŠçŽ ã§ããæå·åããŒã¯è¬ã®ãŸãŸã§ãã
ãã®çµæããæå·åã¢ã«ãŽãªãºã ãã©ã®ããã«èŠã€ããã©ãã§ããŒãå ¥æãããããšãã質åã«çŽé¢ããŸããåççãªã¢ã€ãã¢ã¯ããã¡ãŒã ãŠã§ã¢ã調ã¹ãããšã§ãã ãã¡ãŒã ãŠã§ã¢ãéã¢ã»ã³ãã©ã«ããŒãããããšããŸããããããã«ããã»ããµã¢ãŒããã¯ãã£ãç¥ããªãããšãæããã«ãªããŸããã å€ãã®ã¢ãŒããã¯ãã£ããããç§ã䜿çšããŠããéã¢ã»ã³ãã©ã¯çŽ50çš®é¡ã®ã¢ãŒããã¯ãã£ããµããŒãããŠãããäžçã«ã¯ããã«å€ãã®ã¢ãŒããã¯ãã£ããããŸãã ãã€ãã³ãŒãã«ãã£ãŠãã©ã®ã¢ãŒããã¯ãã£ãæ±ã£ãŠããããåžžã«å€æããããšã¯ã§ããŸããã ãã¡ã€ã«ã«ããããŒãããå Žåã.exeãã¡ã€ã«ãŸãã¯ELFã§ããå Žåã1ã€ã§ãã ããããç§ã®ç®ã®åã«ã¯20ã¡ã¬ãã€ããã倧ãããã€ããªãã¡ã€ã«ããããŸããã ãã®ãã¡ã€ã«ã®åæãçæéã§éå§ã§ããªãã£ããããå¥ã®ã¢ã€ãã¢ãè©Šãããšã«ããŸããã
ãããã8ãã€ããããã¯ã®æãäžè¬çãªæå·åã¢ã«ãŽãªãºã ã䜿çšãããŠãããšä»®å®ãããšã©ããªããŸããïŒ ããã¯ããããDESã¢ã«ãŽãªãºã ã§ãã
2çªç®ã®è³ªåã¯ããæå·åããŒã¯ã©ãã«ãããŸããïŒãã§ãã ãã®ãããªè±èªã®åèªããããŸã-ããŒãã³ãŒããããŠããŸãã å€ãã®ã»ãã¥ãªãã£ã·ã¹ãã ã§ã¯ãæ©å¯æ§ã®åºæ¬ãšãªãèŠçŽ ãå®è¡å¯èœãã¡ã€ã«ã«ããŒãã³ãŒãã£ã³ã°ãããŠããŸãã ãããããã¡ãŒã ãŠã§ã¢ã§æå·åããŒãæ¢ããšã©ããªããŸããïŒ
ãã®çµæã20è¡ã®ããã°ã©ã ãæžã蟌ãŸãããã¡ãŒã ãŠã§ã¢ã§ãã¡ã€ã«ãéããã¡ã¢ãªã«èªã¿èŸŒã¿ãæåã®8ãã€ããååŸããäžèšã®é¢æ°ã§æå·åããŒãšããŠè§£éããããšããŸããã 次ã«ããã¡ã€ã«ã®æåŸãŸã§1ãã€ãã2ãã€ãã®ãªãã»ããã§8ãã€ãã®ãããã¯ãåããŸããã å¿ èŠãªäžèŽããã£ãå ŽåïŒã€ãŸããBase64ã®ãšã³ã³ãŒãããã³ãšã³ã³ãŒãåŸã«ãåä¿¡ããäºå®ã®è¡ã衚瀺ãããå ŽåïŒã察å¿ããã¡ãã»ãŒãžã衚瀺ãããŸããã
ããŒã¯ãã¡ã€ã«å ã§12åæ€åºãããå®å šã«è«ççãªãã€ãã·ãŒã±ã³ã¹ãè¡šããŠããããšãå€æããŸããã
01 02 03 04 05 06 07 08
ãã®ã·ãŒã±ã³ã¹ãããŒã®äžéšã§ãããã©ããããããããŸããã ããããããŒã¯è€éã§è€éãªæ¹æ³ã§çæãããŸããããã®è¡ã¯DESã«é©ããããŒã§ãããå¿ èŠãªå€æãè¡ãé¢æ°ãååŸã§ããŸãã
ãã®çµæãpyDesã©ã€ãã©ãªã䜿çšããŠPythonã§ãããã®ããã·ã¥ïŒããã·ã¥ã§ã¯ãªããæå·åãããå¯éãã¹ã¯ãŒãã§ããããšãå€æããïŒã埩å·åããããã®ã³ãŒãã¯10è¡ã«åãŸããŸãã
from pyDes import * charset = """!"#$%&'()*+,-./0123456789:;<=>a@""" \ + """ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`""" def numFromHash(s): return reduce (lambda v, c: (v << 6) + charset.index(c), s, 0L) def restorePwd(s): v = ("%036X" % numFromHash(s)).decode("hex") k = des("0102030405060708".decode("hex")) pwd = k.decrypt(v[0:8]) + k.decrypt(v[8:16]) return pwd.rstrip('\0')
é埳
ã³ãŒãåââæããšãŠãç°¡åãªã®ã¯ãªãã§ããïŒ ã³ãŒãã¯ãã³ãŒãã®å¹çãäžè²«æ§ãããã³ç解ã«éç¹ã眮ããŠããããã°ã©ããŒã«ãã£ãŠäœæãããŠããããã§ãã ããšãã°ã2çªç®ã®äŸã§éæšæºã ã£ããã®ã¯äœã§ããïŒ Base64å€æããŒãã«ã¯æšæºã§ã¯ãããŸããããåæã«ããŒãã«èªäœã¯çµ±èšã«åºã¥ããŠèŠçŽ çã«åŸ©å ãããŸãã ãã以å€ã¯ãã¹ãŠãå žåçãªåŠçã©ãã®ã¢ãããŒãã§ãã ããã§ã¯ã埩æ§ããã»ã¹ãè€éã«ãããããªãã€ã©ã€ãã¯ãããŸããã éçºè ã¯ãã®ãããªã¿ã¹ã¯ãèšå®ããªãã£ããããããŸããããäžè¬ã«ãæ å ±ã»ãã¥ãªãã£ã®åéã§äœæ¥ããŠããå ŽåãèŠçŽ ãéçºãããšãã«ãã§ããã ãåçŽã§ç解ãããããã®ã«ããããšããªãã§ãã ããã çžæã¯ããã°ã©ããŒãšããŠè«ççã«èããããšããããªãã決å®ã«å ¥ãããã¹ãŠã®ã¡ã«ããºã ãéåžžã«è¿ éã«æããã«ããããšããã®ã§ãããã¯ããªãã«ãšã£ãŠæšªåãã«ãªããããããŸããã